TODO

It'd be better to run this as a post-processing hook on logrotate. But logrotate doesn't get run on /var/log/syslog or /var/log/auth.log; they're rotated with savelog (from /etc/cron.daily/sysklogd) instead of logrotate.

We should probably be monitoring some other log files, in addition to syslog and auth.log.